2.0 Analysis 2.1 Engine Failure The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined. The chip detector would have increased the probability of giving the pilot advance warning of the impending engine failure and might have influenced his decision making had it been operational in flight. 2.2 Engine Chip Detector The chip detector system, as installed, is not able to warn the pilot of ferrous material generated by all the engine components. Installation of a second chip detector, in the location of the AGB drain plug, would allow for the monitoring of all the unfiltered oil, and would also indicate the presence of ferrous particles if tied into the existing chip indicating system. The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles. The engine manufacturer has advised that this chip detecting configuration also exists on the other aircraft types equipped with the PT-6 engine. 2.3 Pilot Decision Making The first indication of a problem was a lower-than-normal oil pressure gauge reading, followed quickly by a low oil pressure flashing caution light, and then a flashing warning light. These progressive indications were designed to alert the pilot to the worsening situation and trigger the required action called for in the POH, i.e. Land as soon as possible. The onset of engine vibrations was a further indication to the pilot that there was an actual problem. The pilot believed that what he was experiencing was an indication problem and, consequently, he did not follow the direction of Land as soon as possible called for in the POH. The aircraft was 39 nm from the St. John's Airport when the low oil pressure warning light illuminated and, based on the time the engine remained operational after this, a landing under engine power could probably have been carried out in St. John's. The aircraft was 44 nm from Gander at the onset of engine vibrations and probably could have reached that airport if a decision had been made to divert there at that time. Another indication that, to the pilot, it was only an indication problem was his decision to start descending as soon as he commenced the turn back to St. John's. The POH states that, if possible, always retain glide capability to the selected landing area in case of total engine failure. Calculations based on the aircraft performance figure charts indicate that, had the pilot maintained 22 000 feet up to the time the engine failed, the aircraft would have been able to glide to the St. John's Airport. There were a number of factors that influenced the pilot's decision to return to St. John's. First, he reportedly had previous experiences of the oil pressure diminishing during the climb and then returning to normal; he was expecting this to happen again. He also thought that the low oil pressure indication was related to an unserviceable low oil quantity annunciating system. Further, the weather in Gander, although not below limits, was not as good as the St. John's weather. St. John's was a maintenance base, and the suspected indicating problem could be quickly rectified and the flight could continue; whereas if he diverted to Gander, the aircraft would be grounded. Lastly, the pilot was advised by maintenance, via dispatch, to return to St. John's. The pilot encountered and failed to recognize an error trap (unsafe actions taken as a result of wrongful assumptions). Error traps are covered in TC-recognized pilot decision-making (PDM) courses. The intent of the PDM course is to reduce risks associated with flight by providing pilots with better decision-making skills. The pilot, who had not had PDM training, did not recognize the error trap, and the subsequent delay in the decision making reduced his options when engine shutdown became inevitable. Ineffective PDM in small air carrier operations has been a matter of concern to the TSB for some time. In 1995, after a spate of occurrences that were linked to ineffective PDM, the Board recommended that: The intent of the recommendation was to communicate the requirement for all aircrew involved in commercial aviation to have the tools and skills needed to reduce the likelihood of inappropriate decisions in the day-to-day commercial flying environment. TC responded to the recommendation by requiring formal CRM and PDM training only for pilots employed by the large commercial air operators (CAR 705 operations). These pilots only receive PDM training during their initial training; there is no requirement for formal recurrent PDM training. SOPs can also help to improve PDM in complex environments. SOPs can be considered to be decisions, made in advance, that tell a pilot how to safely proceed in an expeditious manner. SOPs help to streamline decision making and are a regulatory requirement for commercial operations where the aircraft must be flown by two or more pilots; however, they are not a requirement for commercial single-pilot operations. The pilot received his simulator training on the Cessna 208, an aircraft type substantially different from the PC-12. The Cessna 208 is not pressurized, whereas the PC-12 is. Overall, the PC-12 is of a more sophisticated concept and design. An engine failure scenario in the Cessna 208 would not have to take into account high altitude considerations such as passenger welfare, strong upper winds, and temperature change. Provided that complex situations such as impending and eventual engine failure at altitude were emphasized, the provision of PC-12 simulator training would have increased the probability of the pilot making effective decisions in the circumstances of the progressive indications of failure. 2.4 Aircraft Systems The aircraft battery can provide electrical power for approximately 30 minutes if the electrical load is reduced to below 50 amps. If windshield heat is selected to the light setting only, battery power duration is reduced to about 24 minutes. If the aircraft is set up for optimum glide rate, it would take 32.5 minutes to descend to sea level from an altitude of 30 000 feet. In the scenario described above, if windshield heat were selected to the light setting, battery power would have been exhausted 8.5 minutes before the aircraft reached the ground. Use of additional equipment during descent, such as windshield heat, landing lights, or attempts at engine restart, would place further demands on the battery's limited supply. In this occurrence, the aircraft stayed airborne for approximately 15 minutes after the engine failed. Therefore, it is probable that the battery would still have been able to power the essential instruments even if windshield heat remained selected on. Notwithstanding, the CARs do not require that SEIFR aircraft have a sufficient emergency electrical supply to power necessary electrical systems throughout the entirety of an engine-out let-down from the aircraft's maximum operating level at an optimal glide speed and configuration. Other rule-making authorities have recognized that standard battery supplies are inadequate for emergency SEIFR purposes. This is reflected in the Australian SEIFR requirement for emergency electrical supply, and a similar requirement is proposed in the European Joint Aviation Requirements--Operations (JAR-OPS) SEIFR draft regulations. The oxygen system is designed to provide oxygen to the crew and passengers for ten minutes. From 25 000 feet (the maximum altitude for passenger carriage in single-pilot IFR operations) it would take 11.5 minutes to descend to 13 000 feet at the optimum glide rate. The oxygen would be depleted 1.5 minutes prior to reaching 13 000 feet. The CARs do not require that pressurized SEIFR aircraft have sufficient supplemental oxygen to allow for an optimal glide profile during an engine-out let-down from the aircraft's maximum operating level until a cabin altitude of 13 000 feet is attained. Since the introduction of the Canadian SEIFR authority in 1993, significant advances have been made in aircraft equipment technologies. GPS satellite navigation in commercial navigation is now common, and automatic engine health and usage monitoring systems (HUMS) and advanced onboard oil debris monitoring systems that can detect non-ferrous oil debris particles are more available. The Australian regulatory authority introduced SEIFR rules, after Canada had done so, and incorporated some of these newer systems into its SEIFR rule. The Australians also require that electrical equipment such as landing lights and radar/radio altimeters be capable of being powered by the aeroplane's emergency electrical supply system (battery). The landing lights and radio altimeter on the accident Pilatus were capable of being powered by the battery; however, this was not a requirement of the Canadian rule. 2.5 De-icing Equipment Weather information provided to the pilot showed that icing was forecast along the route of flight. CARs require that the aircraft's de-icing equipment be serviceable prior to departure; however, the aircraft departed with an inoperative wing de-icing system. Had the pneumatic de-icing boots been serviceable for the flight, they would have been rendered inoperative after engine shutdown; consequently, the pilot would have been unable to clear ice from critical surfaces during an engine-out let-down through icing conditions. Even small amounts of ice on critical surfaces can have an adverse effect on aircraft handling characteristics, gliding performance, and stall speed. The pilot would need to be aware of this and allow for the adverse effects during the let-down and landing phase. 3.0 Conclusions 3.1 Findings The pilot's records indicated that he was certified, trained, and qualified for the flight in accordance with existing regulations. The maintenance records indicate that the aircraft was maintained in accordance with existing regulations. The weight and centre of gravity were within the prescribed limits. The aircraft did not meet the approval requirements for SEIFR flight because the engine chip detector was not operational during flight. The engine chip detecting system, as it is presently configured on the PC-12, does not monitor the entire engine lubricating system for ferrous particles. The pilot stated that he had experienced unusual engine oil pressure indications on the occurrence aircraft in the past. The pilot was aware that the low oil quantity annunciating system was unserviceable prior to the occurrence flight. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined. There is no history of a similar type failure. The indications of low oil pressure were genuine, but were not considered valid by the pilot; this was an error trap (unsafe actions taken as a result of wrongful assumptions, unsafe conditions or practices) that the pilot did not recognize. Thus, he did not follow the Land as soon as possible instruction called for in the Emergencies section of the POH. The terms Land as soon as possible and Land as soon as practical are not defined in the POH. Contrary to the recommended procedure of retaining glide capability, the pilot commenced a descent as soon as the aircraft turned back towards St. John's. The aircraft departed into a region where icing had been forecast with a wing de-icing system that was inoperative. There are no means to clear ice from critical wing surfaces on the PC-12 once the engine has been shut down; pilots would need to compensate for the adverse effects of ice during the let-down and landing. The ELT had been removed prior to the flight for maintenance; CAR 605.39 allows for flight without an ELT for up to 90 days. The CARs do not require pilots involved in SEIFR to have received pilot decision-making training. The CARs that govern SEIFR do not list as part of the REL a system capable of monitoring and recording those parameters critical to engine performance and condition. The CARs do not require that pressurized SEIFR aircraft have sufficient supplemental oxygen to allow for an optimal glide profile during an engine-out let-down from the aircraft's maximum operating level until a cabin altitude of 13 000 feet is attained. The CARs do not require that SEIFR aircraft have a sufficient emergency electrical supply to power necessary electrical systems throughout the entirety of an engine-out let-down from the aircraft's maximum operating level at an optimal glide speed and configuration. The equipment standard for SEIFR in the CARs is not as stringent as that of other regulatory aviation authorities, such as the Australian regulatory authority. 3.2 Causes The pilot did not follow the prescribed emergency procedure for low oil pressure, and the engine failed before he could land safely. The pilot's decision making was influenced by his belief that the low oil pressure indications were not valid. The engine failed as a result of an interruption of oil flow to the first-stage planet gear assembly; the cause of the oil flow interruption could not be determined. 4.0 Safety Action 4.1 Action Taken 4.1.1 Chip Detector Operability As the chip detector was rendered inoperable when the landing gear was retracted, the aircraft did not meet the approval requirements for SEIFR flight, which requires a chip detector system to warn the pilot of excessive ferrous material in the engine lubricating system. When apprised of the situation, TC, on 15 July 1998, sent a letter to all TC regional managers for redistribution to all operators of Canadian-registered PC-12 aircraft advising them that they had 90 days to modify their aircraft to make the chip detector functional in all regimes of flight. 4.1.2 ELT Availability There is a proposed CAR amendment which will allow CAR 703 air taxi operations for up to thirty days without an ELT on board. For private owners, or operators who have a low aircraft utilization rate and low overall risk, 30 days may be an appropriate period of time to allow flight without an ELT; however, for commercial operators with a high utilization rate, or for those who are performing operations that involve greater risk, 30 days may represent an unacceptable period of operation for flight without an ELT. Therefore, the TSB forwarded a Safety Advisory letter to TC which suggested that TC consider a further reduction or elimination of the 30-day allowance for commercial operators. There is also a Notice of Proposed Amendment to reduce the allowable time period for flight without an operable ELT for aircraft operated under CAR 705 and CAR 704. 4.1.3 Emergency Procedures Terminologies Some aircraft manufacturers define the terms possible and practical, and employ only these defined terms. Similarly, TC, in its Extended Range Twin-Engine Operations (ETOPS) Manual, defines suitable and adequate airports. This reduces subjectivity and allows all involved (manufacturers, pilots, dispatchers, and maintenance personnel) to accurately and similarly gauge the degree of urgency related to an airborne emergency. Consistent interpretation of terminology related to emergency procedures is necessary to ensure an appropriate response. Consequently, the TSB, on 18 June 1998, forwarded a Safety Advisory letter to TC to suggest that TC consider a means to standardize these terms throughout the aviation industry. TC responded to the Safety Advisory letter by issuing, on 21 October 1999, Commercial and Business Aviation Advisory Circular (CBAAC 0163), which deals with standardisation of terminology related to aircraft emergency procedures. TC has also asked Pilatus Aircraft to review the PC-12 POH with regard to this subject and has recommended that the POH include comprehensive definitions of the terms that are used. 4.2 Action Required 4.2.1 Oxygen System Requirements The requirement for pressurized aircraft to carry a supplemental oxygen supply is set out in CAR 605.31. The CAR requires a ten-minute minimum supply of oxygen for passengers and crew, or an amount sufficient to allow an emergency descent to below 13 000 feet, whichever is greater. The standard oxygen system on board the Pilatus PC-12 meets the requirements set out in these CARs (ten minutes). The SEIFR rule does not stipulate any additional oxygen equipment requirements. According to the POH, the standard PC-12 oxygen system is for use by crew and passengers in the event of contaminated air being introduced into the cabin or a loss of pressurization with a rapid descent to lower altitudes. The system will supply two crew and nine passengers for a minimum of 10 minutes in which time a descent from 30 000 feet to 10 000 feet is performed. A rapid descent is the best course of action for air contamination or depressurization while under power; however, if the aircraft loses pressurization due to engine failure, a rapid descent would compromise the aircraft's glide profile and lessen the chances of reaching a suitable aerodrome.